VBoot Reference: Add version checking to for preventing rollbacks.

src/platform/vboot_reference/include/firmware_image.h

 /* Copyright (c) 2010 The Chromium OS Authors. All rights reserved.
  * Use of this source code is governed by a BSD-style license that can be
  * found in the LICENSE file.
  *
  * Data structure and API definitions for a verified boot firmware image.
  */
 
 #ifndef VBOOT_REFERENCE_FIRMWARE_IMAGE_H_
 #define VBOOT_REFERENCE_FIRMWARE_IMAGE_H_
 
 #include <inttypes.h>
 
 #include "rsa.h"
 #include "sha.h"
 
 #define FIRMWARE_MAGIC "CHROMEOS"
 #define FIRMWARE_MAGIC_SIZE 8
 #define FIRMWARE_PREAMBLE_SIZE 8
 
 /* RSA 8192 and SHA-512. */
 #define ROOT_SIGNATURE_ALGORITHM 11
 #define ROOT_SIGNATURE_ALGORITHM_STRING "11"
 
 typedef struct FirmwareImage {
   uint8_t magic[FIRMWARE_MAGIC_SIZE];
   /* Key Header */
   uint16_t header_len;  /* Length of the header. */
   uint16_t firmware_sign_algorithm;  /* Signature algorithm used by the signing
                                       * key. */
+  uint16_t firmware_key_version;  /* Key Version# for preventing rollbacks. */
   uint8_t* firmware_sign_key;  /* Pre-processed public half of signing key. */
-  uint16_t firmware_key_version;  /* Key Version# for preventing rollbacks. */
   uint8_t header_checksum[SHA512_DIGEST_SIZE];  /* SHA-512 hash of the header.*/
 
   uint8_t firmware_key_signature[RSA8192NUMBYTES];  /* Signature of the header
                                                      * above. */
 
   /* Firmware Preamble. */
   uint16_t firmware_version;  /* Firmware Version# for preventing rollbacks.*/
   uint64_t firmware_len;  /* Length of the rest of the R/W firmware data. */
   uint8_t preamble[FIRMWARE_PREAMBLE_SIZE];  /* Remaining preamble data.*/
 
@@ skipping 64 matching lines @@
 void PrintFirmwareImage(const FirmwareImage* image);
 
 /* Error Codes for VerifyFirmware* family of functions. */
 #define VERIFY_FIRMWARE_SUCCESS 0
 #define VERIFY_FIRMWARE_INVALID_IMAGE 1
 #define VERIFY_FIRMWARE_ROOT_SIGNATURE_FAILED 2
 #define VERIFY_FIRMWARE_INVALID_ALGORITHM 3
 #define VERIFY_FIRMWARE_PREAMBLE_SIGNATURE_FAILED 4
 #define VERIFY_FIRMWARE_SIGNATURE_FAILED 5
 #define VERIFY_FIRMWARE_WRONG_MAGIC 6
-#define VERIFY_FIRMWARE_MAX 7  /* Generic catch-all. */
+#define VERIFY_FIRMWARE_WRONG_HEADER_CHECKSUM 7
+#define VERIFY_FIRMWARE_KEY_ROLLBACK 8
+#define VERIFY_FIRMWARE_VERSION_ROLLBACK 9
+#define VERIFY_FIRMWARE_MAX 10  /* Total number of error codes. */
 
 extern char* kVerifyFirmwareErrors[VERIFY_FIRMWARE_MAX];
 
 /* Checks for the sanity of the firmware header pointed by [header_blob].
  * If [dev_mode] is enabled, also checks the root key signature using the
  * pre-processed public root key [root_key_blob].
  *
  * On success, put signature algorithm in [algorithm], header length
  * in [header_len], and return 0.
  * Else, return error code on failure.
@@ skipping 64 matching lines @@
  */
 int AddFirmwareKeySignature(FirmwareImage* image, const char* root_key_file);
 
 /* Add firmware and preamble signature to a firmware image [image]
  * using the private signing key in file [signing_key_file].
  *
  * Return 1 on success, 0 on failure.
  */
 int AddFirmwareSignature(FirmwareImage* image, const char* signing_key_file);
 
+/* Returns the logical version of a firmware blob which is calculated as
+ * (firmware_key_version << 16 | firmware_version). */
+uint32_t GetLogicalFirmwareVersion(uint8_t* firmware_blob);
+
+#define  BOOT_FIRMWARE_A_CONTINUE 1
+#define  BOOT_FIRMWARE_B_CONTINUE 2
+#define  BOOT_FIRMWARE_RECOVERY_CONTINUE 3
+
+/* This function is the driver used by the RO firmware to
+ * determine which copy of the firmware to boot from. It performs
+ * the requisite rollback index checking, including updating them,
+ * if required.
+ *
+ * Returns the code path to follow. It is one of:
+ * BOOT_FIRMWARE_A_CONTINUE          Boot from Firmware A
+ * BOOT_FIRMWARE_B_CONTINUE          Boot from Firmware B
+ * BOOT_FIRMWARE_RECOVERY_CONTINUE   Jump to recovery mode
+ */
+int VerifyFirmwareDriver_f(uint8_t* root_key_blob,
+                           uint8_t* firmwareA,
+                           uint8_t* firmwareB);
+
 #endif  /* VBOOT_REFERENCE_FIRMWARE_IMAGE_H_ */